Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

DebtToken's mint function returns incorrect scaled amount

shui

Summary

The mint function in DebtToken.sol returns amountToMint (which includes interest) instead of amountScaled as specified in its documentation, violating the function's interface specification.

Vulnerability Details

The mint function's documentation specifies that it should return the amount of scaled tokens minted as its second return value:

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/tokens/DebtToken.sol#L167

​
/**
* @return A tuple containing:
* - bool: True if the previous balance was zero
* - uint256: The amount of scaled tokens minted
* - uint256: The new total supply after minting
*/
function mint(
address user,
address onBehalfOf,
uint256 amount,
uint256 index
) external override onlyReservePool returns (bool, uint256, uint256) {
uint256 amountScaled = amount.rayDiv(index);
// ...
uint256 amountToMint = amount + balanceIncrease;
_mint(onBehalfOf, amountToMint.toUint128());
​
// @audit Returns amountToMint instead of amountScaled
return (scaledBalance == 0, amountToMint, totalSupply());
}

The function calculates amountScaled correctly but returns amountToMint which includes both the new amount and accrued interest. This doesn't match the documented behavior which should return the scaled amount of new tokens minted.

Impact

Low. While this is technically incorrect and violates the interface specification with the lending pool receiving this variable after the minting, it is not used.

Recommended Mitigation

Return amountScaled instead of amountToMint to match the documented behavior:

return (scaledBalance == 0, amountScaled, totalSupply());
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.